479 reputation
49
bio website
location
age
visits member for 2 years
seen Dec 16 at 16:53

Sep
4
comment Where can I “hide” easter eggs for students learning about Linux security?
@Polynomial: Wow. Yes that's evil. I think that's beyond our current skillset at this point. Awesome though - thanks again!
Sep
4
comment Where can I “hide” easter eggs for students learning about Linux security?
Thanks so much!
Jul
24
comment Does a virus need to be clicked on to function?
Can you elaborate on disabling "Certain javascript"? I've heard of some people disabling js entirely for security purposes, but how do you do so selectively?
Oct
15
comment Why are the first 16 bits of the message digest not encrypted in PGP?
I don't know anything about PGP, but is there a chance it's an initialization vector? If so, that's not supposed to be encrypted.
Sep
19
comment Is there any way to cryptographically hash a human thumbprint?
Haha, get it? "Indexing" key?
Sep
11
comment Should I know my users passwords so I can check they can logon?
@Xander: at some point, you MUST trust your admins. That's why they're admins. They likely have direct access to databases anyway. I see your point, and you CAN mitigate some of this risk by maintaining audit records which those admins do NOT have access to modify. But if you have trust issues with people who directly access the databases, there are bigger problems than the possibility that they're twiddling with individual users' passwords.
Sep
9
comment Did US and UK spy agencies defeat privacy and security on the internet?
How would an implementation difference make them inoperable? I think what this.josh is implying is not that they produce different results, but perhaps one has an insecurity in the PROCESS, not in the RESULT.
Aug
30
comment Changing picture as characters entered into password
It's been my impression that these visual hashing schemes aren't intended to inform the user AS THEY TYPE, but AFTER they've FINISHED typing, such that they can know before they hit Enter whether they've messed up their password or not. I actually use Lotus at work for email, and I don't even look at the pattern while I type. But if I finish typing my password and I don't see a purple keychain, I know already that I have to start over (without having to hit Enter, get a "failure prompt, and THEN know that I messed up)
Aug
19
comment An attempt to overcome the key distribution problem inherent in one time pad cryptography
HAC looks like a good read. I see that it was written in 1996 - does that mean it is "old" in the sense that some of it will be out of date? If I read it, will what I learn be out of date? Or does this stuff in general develop slowly enough that it's still relevant?
Nov
28
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
This doesn't address the actual questions in the OP, though. :-(
Nov
28
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
@Blrfl: Maybe. To be fair to him, though, this was in the context of a regular newsletter that he sends anyway, so maybe it was less of a "finger-wagging" and more of, "Gee, I forgot to come up with something for the newsletter." :-)
Nov
28
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
@D.W. : Maybe I have misconstrued my stance on this. I'm not "worked up" over it. My initial email to him was out of honest, genuine curiosity. I regret that I only took one crypto class in school, since it truly fascinates me. I was just blown away that he claimed to have cracked "100%" of them; When he reaffirmed via email reply that, 'Yes, it was indeed 100% of them', I wasn't "interpreting statements in an overly-precise way" - that's what he really said (and confirmed!). It's not that "someone is wrong on the Internet" - I honestly wondered if it was plausible, so I took it to SE.com
Nov
28
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
@Blrfl: Just to be clear, he didn't claim that 100% of the passwords were weak, he claimed that many of them were weak after he cracked "100%" of them to check their security.
Nov
28
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
@ThomasPornin: No, he didn't reply to my second email. I see 3 possibilities: (1) He has the answer, but since he's a VP, I was lucky to have received the FIRST reply, let alone expect a second, (2) I called his bluff and he doesn't want to let on by replying without the answer, or (3) he went and rented several Amazon EC2 instances and is furiously running ONLY MY password hash through his tools so he doesn't have to admit he lied. :-)
Nov
28
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
Note that I emailed him about it, and he replied insisting that he had indeed cracked "all" of them. This very claim is what makes me wonder if it's a dubious claim.